feat(proxy-backend): limit the forwarded http headers to a safe set

docs/plugins/proxying.md

@@ -57,6 +57,15 @@ is also possible to limit the forwarded HTTP methods with the configuration
 `allowedMethods`, for example `allowedMethods: ['GET']` to enforce read-only
 access.
 
+By default, the proxy will only forward safe HTTP request headers to the target.
+Those are based on the headers that are considered safe for CORS and includes
+headers like `content-type` or `last-modified`, as well as all headers that are
+set by the proxy. If the proxy should forward other headers like
+`authorization`, this must be enabled by the `allowedHeaders` config, for
+example `allowedHeaders: ['Authorization']`. This should help to not
+accidentally forward confidential headers (`cookie`, `X-Auth-Request-User`) to
+third-parties.
+
 If the value is a string, it is assumed to correspond to:
 
 ```yaml